topic Re: How to forward a specific syslog file into Splunk? in Getting Data In

How to forward a specific syslog file into Splunk?

erinaldo — Tue, 07 Feb 2017 19:20:06 GMT

Hello all,

I'm looking for guidance about a logging problem I am trying to solve. Right now we have a few security onion boxes sending snort logs to both our log server and to Splunk using syslog-ng. This works fine.

The powers that be now want to remove the direct send to Splunk and just pipe the logs from the syslog box into Splunk. What I would like to do is just forward these specific log files which are under /var/log/remote/IP1, /var/log/remote/IP2 to the Splunk box. Is there an easy way to accomplish this or do I need to get cute with eventtypes..etc? Hopefully that makes sense.

Re: How to forward a specific syslog file into Splunk?

richgalloway — Tue, 07 Feb 2017 21:03:52 GMT

Piping syslog through an intermediate server is accepted Best Practice to avoid losing data.

Re: How to forward a specific syslog file into Splunk?

cpetterborg — Tue, 07 Feb 2017 21:33:42 GMT

If you have the UF on your syslog collector, just configure your inputs to monitor those files. Example inputs.conf:

[monitor:///var/log/remote/IP1]
host=IP1
sourcetype=syslog
index=syslogidx

[monitor:///var/log/remote/IP2]
host=IP2
sourcetype=syslog
index=syslogidx

If you need something more sophisticated, explain that scenario.

Re: How to forward a specific syslog file into Splunk?

erinaldo — Tue, 07 Feb 2017 22:15:50 GMT

I ended up setting up a forward in rsyslog. So it logs into /var/log/remote/ip.log then forwards to Splunk.
if $fromhost-ip=='192.168.211.2' then @192.168.211.3:514

Is it better to use the universal forwarder?

Re: How to forward a specific syslog file into Splunk?

richgalloway — Tue, 07 Feb 2017 22:18:57 GMT

Yes, the universal forwarder is better. It handles retry, throttling, and more that rsyslog doesn't.

Re: How to forward a specific syslog file into Splunk?

cpetterborg — Tue, 07 Feb 2017 22:21:35 GMT

Most definitely I agree. It's too easy to loose syslog data. The forwarder on the syslog server is the best way to go.

Re: How to forward a specific syslog file into Splunk?

erinaldo — Tue, 07 Feb 2017 22:35:01 GMT

Thanks for your help.